aws ssm start-automation-execution not accepting taget filtering by multiple tags

[RoshmiB]

While running this command:-
aws --region us-west-2 ssm start-automation-execution
--document-name "AWS-ResizeInstance"
--parameters "InstanceType=t3a.small,AutomationAssumeRole=arn:aws:iam::<master_acc_id>:role/AWS-SystemsManager-AutomationAdministrationRole"
--target-parameter-name InstanceId
--targets Key=tag:MaintenanceDays,Values=30,127 Key=tag:MaintenanceTimeStart,Values=12
--target-locations Accounts=<target_acc_id>,Regions=us-west-2,us-east-2,ExecutionRoleName=AWS-SystemsManager-AutomationExecutionRole

It is throwing error :- botocore.errorfactory.InvalidAutomationExecutionParametersException: An error occurred (InvalidAutomationExecutionParametersException) when calling the StartAutomationExecution operation: Only one resource group or tag can be specified at a time

aws --version :-
aws-cli/2.15.36 Python/3.11.8 Linux/5.15.146.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off

[uldyssian-sh]

This is expected behavior.

For SSM Automation, start-automation-execution supports targeting by either:

• one tag key (Key=tag:..., Values=...), or
• one Resource Group

It does not support combining multiple tag keys (logical AND) in --targets, so when you pass two different tag: keys you get:

Only one resource group or tag can be specified at a time

If you need “instances that match multiple tags”, use one of these correct approaches.

Approach 1 (recommended): create a Resource Group with a tag query that includes both tag conditions, then target the automation by that single Resource Group.

Create/update a resource group (example query requiring both tags):

aws resource-groups create-group
--name "MaintenanceWindow-30-12"
--resource-query '{
"Type":"TAG_FILTERS_1_0",
"Query":"{"ResourceTypeFilters":["AWS::EC2::Instance"],"TagFilters":[{"Key":"MaintenanceDays","Values":["30","127"]},{"Key":"MaintenanceTimeStart","Values":["12"]}]}"
}'

Then run automation using that one resource group as the target:

aws --region us-west-2 ssm start-automation-execution
--document-name "AWS-ResizeInstance"
--parameters "InstanceType=t3a.small,AutomationAssumeRole=arn:aws:iam::<master_acc_id>:role/AWS-SystemsManager-AutomationAdministrationRole"
--target-parameter-name InstanceId
--targets Key=resource-groups:Name,Values=MaintenanceWindow-30-12
--target-locations Accounts=<target_acc_id>,Regions=us-west-2,us-east-2,ExecutionRoleName=AWS-SystemsManager-AutomationExecutionRole

Approach 2: resolve InstanceIds yourself (multi-tag filter) and pass the explicit InstanceId list to the runbook (works if the document supports multiple InstanceIds).

Example to get matching InstanceIds in one region:

INSTANCE_IDS=$(aws ec2 describe-instances
--region us-west-2
--filters "Name=tag:MaintenanceDays,Values=30,127" "Name=tag:MaintenanceTimeStart,Values=12"
--query "Reservations[].Instances[].InstanceId"
--output text)

Then start the automation using those InstanceIds (format may vary by document; many SSM docs accept comma-separated or JSON list):

aws --region us-west-2 ssm start-automation-execution
--document-name "AWS-ResizeInstance"
--parameters "InstanceId=$INSTANCE_IDS,InstanceType=t3a.small,AutomationAssumeRole=arn:aws:iam::<master_acc_id>:role/AWS-SystemsManager-AutomationAdministrationRole"

Summary:

Your command fails because Automation only allows one tag key (or one resource group) in --targets.
Use a Resource Group (best for multiple tags), or precompute InstanceIds and pass them explicitly.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊